Users – click in this box and start typing the name of users to display search results for.Leave this box blank to return entries for all audited activities. For a partial list of audited activities, see Audited activities.

Use the search box to search for activities to add to the list. Activities – select the activities to search for.The date and time are presented in local time.

Date and time range – select a date and time range to display the events that occurred within that period.

On the Audit page, configure the search using the following conditions on the Search tab:.

In the left navigation pane click on “ Audit“:.

To search in Microsoft 365 compliance center’s audit log, do the following: For more information, see Manage role groups in Exchange Online. To give a user the ability to search the audit log with the minimum level of privileges, you can create a custom role group in Exchange Online, add the “View-Only Audit Logs” or “Audit Logs” role, and then add the user as a member of the new role group. Global administrators in Microsoft 365 and Microsoft 365 are automatically added as members of the “Organization Management” role. This screenshot shows the two audit-related roles assigned to the “Compliance Management” role group: By default, these roles are assigned to the “Compliance Management” and the “Organization Management” role groups in the Exchange admin center. Assign permissions to search the audit logĪdmins and members of investigation teams must be assigned the “View-Only Audit Logs” or “Audit Logs” role in Exchange Online to search the audit log. The only setup before you and others in your organization can search in the audit log is to assign the necessary permissions to access the audit log search tool.

1-year audit record retention (can be extended to 10 years, with additional licenses)īasic Audit is enabled by default for all organizations with the appropriate subscription (for a list of subscription and licensing requirements, see Auditing solutions in Microsoft 365).

Microsoft 365 provides two auditing solutions: Typical document management activities that you can search for in the logs are: Using the audit log search tool, you can search for, view, and export (to a CSV-file) the audit records for any of these operations. Thousands of user and admin operations, performed in dozens of Microsoft 365 services and solutions, are captured, recorded, and retained in a unified audit log, available in Microsoft 365 compliance center.

Office 365 audit